@deploily/deploily-cli 0.1.0

package/dist/utils/pkce.js

@@ -0,0 +1,30 @@
+import crypto from "crypto";
+// Generate a cryptographically secure random string
+export function generateRandomString(length = 32) {
+    return crypto.randomBytes(length).toString("hex");
+}
+// Generate PKCE code verifier
+export function generateCodeVerifier() {
+    const length = 128;
+    const charset = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~";
+    let result = "";
+    const randomValues = crypto.getRandomValues(new Uint8Array(length));
+    for (let i = 0; i < length; i++) {
+        result += charset[randomValues[i] % charset.length];
+    }
+    return result;
+}
+// Generate PKCE code challenge from verifier
+export function generateCodeChallenge(codeVerifier) {
+    const hash = crypto.createHash("sha256").update(codeVerifier).digest();
+    return hash
+        .toString("base64")
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_")
+        .replace(/=+$/, "");
+}
+// Generate state parameter for CSRF protection
+export function generateState() {
+    return generateRandomString(32);
+}
+//# sourceMappingURL=pkce.js.map

package/dist/utils/pkce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../../src/utils/pkce.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAA;AAE3B,oDAAoD;AACpD,MAAM,UAAU,oBAAoB,CAAC,SAAiB,EAAE;IACtD,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AACnD,CAAC;AAED,8BAA8B;AAC9B,MAAM,UAAU,oBAAoB;IAClC,MAAM,MAAM,GAAG,GAAG,CAAA;IAClB,MAAM,OAAO,GACX,oEAAoE,CAAA;IACtE,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,MAAM,YAAY,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAA;IAEnE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAChC,MAAM,IAAI,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACrD,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,qBAAqB,CAAC,YAAoB;IACxD,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAA;IACtE,OAAO,IAAI;SACR,QAAQ,CAAC,QAAQ,CAAC;SAClB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AACvB,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,aAAa;IAC3B,OAAO,oBAAoB,CAAC,EAAE,CAAC,CAAA;AACjC,CAAC"}

package/package.json

@@ -0,0 +1,37 @@
+{
+  "name": "@deploily/deploily-cli",
+  "version": "0.1.0",
+  "description": "Deploily CLI - Deploy and manage your applications with ease",
+  "license": "APACHE-2.0",
+  "keywords": [
+    "cli",
+    "deployment",
+    "deploily"
+  ],
+  "type": "module",
+  "main": "dist/index.js",
+  "bin": {
+    "deploily": "dist/index.js"
+  },
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsx src/index.ts",
+    "start": "node dist/index.js"
+  },
+  "dependencies": {
+    "@deploily/deploily-cli": "link:",
+    "@hono/node-server": "^2.0.6",
+    "axios": "^1.18.1",
+    "chalk": "^5.6.2",
+    "dotenv": "^17.4.2",
+    "open": "^11.0.0"
+  },
+  "optionalDependencies": {
+    "keytar": "^7.9.0"
+  },
+  "devDependencies": {
+    "@types/node": "^25.9.3",
+    "tsx": "^4.22.4",
+    "typescript": "^6.0.3"
+  }
+}

package/pnpm-workspace.yaml

@@ -0,0 +1,5 @@
+allowBuilds:
+  esbuild: false
+  keytar: false
+overrides:
+  '@deploily/deploily-cli': 'link:'

package/src/auth/callback.ts

@@ -0,0 +1,159 @@
+import http from "http"
+import { URL } from "url"
+import { AUTH_CONFIG } from "../config/constants.js"
+import { CallbackResult } from "../types/index.js"
+
+// Start local HTTP server to listen for OAuth callback
+export async function startCallbackServer(
+  expectedState: string,
+): Promise<CallbackResult> {
+  return new Promise((resolve, reject) => {
+    const server = http.createServer((req, res) => {
+      if (!req.url) {
+        res.writeHead(400)
+        res.end("Bad request")
+        return
+      }
+
+      const url = new URL(
+        req.url,
+        `http://localhost:${AUTH_CONFIG.CALLBACK_PORT}`,
+      )
+      const code = url.searchParams.get("code")
+      const state = url.searchParams.get("state")
+      const error = url.searchParams.get("error")
+      const errorDescription = url.searchParams.get("error_description")
+
+      // Handle errors from Keycloak
+      if (error) {
+        const errorMsg = errorDescription || error
+        res.writeHead(400, { "Content-Type": "text/html" })
+        res.end(`
+          <!DOCTYPE html>
+          <html>
+          <head>
+            <title>Authentication Failed</title>
+            <style>
+              body {
+                font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;
+                display: flex;
+                justify-content: center;
+                align-items: center;
+                height: 100vh;
+                margin: 0;
+                background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
+              }
+              .container {
+                background: white;
+                padding: 40px;
+                border-radius: 8px;
+                box-shadow: 0 10px 25px rgba(0, 0, 0, 0.2);
+                max-width: 500px;
+                text-align: center;
+              }
+              h1 { color: #e74c3c; margin-top: 0; }
+              p { color: #555; line-height: 1.6; }
+              code { background: #f5f5f5; padding: 2px 6px; border-radius: 3px; }
+            </style>
+          </head>
+          <body>
+            <div class="container">
+              <h1>Authentication Failed</h1>
+              <p>Error: <code>${escapeHtml(errorMsg)}</code></p>
+              <p>Please try again with: <code>deploily login</code></p>
+            </div>
+          </body>
+          </html>
+        `)
+        server.close()
+        reject(new Error(`Authentication failed: ${errorMsg}`))
+        return
+      }
+
+      // Validate callback
+      if (!code || !state) {
+        res.writeHead(400)
+        res.end("Missing code or state parameter")
+        server.close()
+        reject(new Error("Missing code or state parameter"))
+        return
+      }
+
+      // Validate state parameter (CSRF protection)
+      if (state !== expectedState) {
+        res.writeHead(403)
+        res.end("Invalid state parameter")
+        server.close()
+        reject(new Error("State parameter mismatch"))
+        return
+      }
+
+      // Success response
+      res.writeHead(200, { "Content-Type": "text/html" })
+      res.end(`
+        <!DOCTYPE html>
+        <html>
+        <head>
+          <title>Authentication Successful</title>
+          <style>
+            body {
+              font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;
+              display: flex;
+              justify-content: center;
+              align-items: center;
+              height: 100vh;
+              margin: 0;
+              background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
+            }
+            .container {
+              background: white;
+              padding: 40px;
+              border-radius: 8px;
+              box-shadow: 0 10px 25px rgba(0, 0, 0, 0.2);
+              max-width: 500px;
+              text-align: center;
+            }
+            h1 { color: #27ae60; margin-top: 0; }
+            p { color: #555; line-height: 1.6; }
+          </style>
+        </head>
+        <body>
+          <div class="container">
+            <h1>Authentication Successful</h1>
+            <p>You have successfully authenticated with Deploily.</p>
+            <p>You can close this window and return to your terminal.</p>
+          </div>
+        </body>
+        </html>
+      `)
+
+      server.close()
+      resolve({ code, state })
+    })
+
+    server.listen(AUTH_CONFIG.CALLBACK_PORT, "localhost", () => {
+      // Server is listening
+    })
+
+    // Set a timeout for the callback
+    const timeout = setTimeout(() => {
+      server.close()
+      reject(new Error("Callback timeout: No response from Keycloak"))
+    }, 300000) // 5 minutes
+
+    server.on("close", () => {
+      clearTimeout(timeout)
+    })
+  })
+}
+
+function escapeHtml(text: string): string {
+  const map: Record<string, string> = {
+    "&": "&amp;",
+    "<": "&lt;",
+    ">": "&gt;",
+    '"': "&quot;",
+    "'": "&#039;",
+  }
+  return text.replace(/[&<>"']/g, (m) => map[m])
+}

package/src/auth/index.ts

@@ -0,0 +1,238 @@
+import axios, { AxiosInstance } from "axios"
+import {
+  generateCodeVerifier,
+  generateCodeChallenge,
+  generateState,
+} from "../utils/pkce.js"
+import { AUTH_CONFIG } from "../config/constants.js"
+import { credentialStorage } from "../storage/credentials.js"
+import {
+  AuthContext,
+  StoredCredentials,
+  TokenResponse,
+  UserInfo,
+} from "../types/index.js"
+
+class AuthenticationService {
+  private client: AxiosInstance
+
+  constructor() {
+    this.client = axios.create({
+      timeout: 10000,
+    })
+  }
+
+  private buildClientAuthHeaders(): Record<string, string> {
+    const clientSecret = process.env.KEYCLOAK_CLIENT_SECRET
+
+    if (!clientSecret) {
+      return {}
+    }
+
+    const clientId = process.env.KEYCLOAK_CLIENT_ID!
+    const basicAuth = Buffer.from(`${clientId}:${clientSecret}`).toString(
+      "base64",
+    )
+
+    return {
+      Authorization: `Basic ${basicAuth}`,
+    }
+  }
+
+  // Generate authorization URL for user login
+  generateAuthorizationUrl(): { url: string; context: AuthContext } {
+    const state = generateState()
+    const codeVerifier = generateCodeVerifier()
+    const codeChallenge = generateCodeChallenge(codeVerifier)
+
+    const params = new URLSearchParams({
+      client_id: AUTH_CONFIG.CLIENT_ID,
+      response_type: AUTH_CONFIG.RESPONSE_TYPE,
+      redirect_uri: AUTH_CONFIG.REDIRECT_URI,
+      scope: AUTH_CONFIG.SCOPE,
+      code_challenge: codeChallenge,
+      code_challenge_method: AUTH_CONFIG.CODE_CHALLENGE_METHOD,
+      state,
+    })
+
+    const url = `${AUTH_CONFIG.KEYCLOAK_AUTH_ENDPOINT}?${params.toString()}`
+
+    return {
+      url,
+      context: { state, codeVerifier, codeChallenge },
+    }
+  }
+
+  // Exchange authorization code for tokens
+  async exchangeCodeForToken(
+    code: string,
+    codeVerifier: string,
+  ): Promise<TokenResponse> {
+    try {
+      const body = new URLSearchParams({
+        grant_type: "authorization_code",
+        code,
+        client_id: process.env.KEYCLOAK_CLIENT_ID!,
+        redirect_uri: process.env.KEYCLOAK_REDIRECT_URI!,
+        code_verifier: codeVerifier,
+      })
+
+      const response = await this.client.post<TokenResponse>(
+        process.env.KEYCLOAK_TOKEN_ENDPOINT!,
+        body,
+        {
+          headers: {
+            "Content-Type": "application/x-www-form-urlencoded",
+            ...this.buildClientAuthHeaders(),
+          },
+        },
+      )
+
+      return response.data
+    } catch (error) {
+      if (axios.isAxiosError(error)) {
+        const responseData =
+          typeof error.response?.data === "string"
+            ? error.response.data
+            : JSON.stringify(error.response?.data ?? {})
+        const authHint =
+          error.response?.status === 401 &&
+          responseData.includes("unauthorized_client")
+            ? " This usually means the Keycloak client is confidential and KEYCLOAK_CLIENT_SECRET is missing or invalid."
+            : ""
+
+        throw new Error(
+          `Failed to exchange code for token: ${error.message}${responseData ? ` (${responseData})` : ""}${authHint}`,
+        )
+      }
+
+      throw new Error(
+        `Failed to exchange code for token: ${error instanceof Error ? error.message : "Unknown error"}`,
+      )
+    }
+  }
+
+  // Refresh access token using refresh token
+  async refreshAccessToken(refreshToken: string): Promise<TokenResponse> {
+    try {
+      const body = new URLSearchParams({
+        grant_type: "refresh_token",
+        refresh_token: refreshToken,
+        client_id: process.env.KEYCLOAK_CLIENT_ID!,
+      })
+
+      const response = await this.client.post<TokenResponse>(
+        process.env.KEYCLOAK_TOKEN_ENDPOINT!,
+        body,
+        {
+          headers: {
+            "Content-Type": "application/x-www-form-urlencoded",
+            ...this.buildClientAuthHeaders(),
+          },
+        },
+      )
+
+      return response.data
+    } catch (error) {
+      throw new Error(
+        `Failed to refresh token: ${error instanceof Error ? error.message : "Unknown error"}`,
+      )
+    }
+  }
+
+  // Get user information from access token
+  async getUserInfo(accessToken: string): Promise<UserInfo> {
+    try {
+      const response = await this.client.get<UserInfo>(
+        process.env.KEYCLOAK_USERINFO_ENDPOINT!,
+        {
+          headers: {
+            Authorization: `Bearer ${accessToken}`,
+          },
+        },
+      )
+
+      return response.data
+    } catch (error) {
+      throw new Error(
+        `Failed to fetch user info: ${error instanceof Error ? error.message : "Unknown error"}`,
+      )
+    }
+  }
+
+  // Store tokens after successful authentication
+  async storeTokens(token: TokenResponse, userEmail?: string): Promise<void> {
+    const expiresAt = Math.floor(Date.now() / 1000) + token.expires_in
+
+    const credentials: StoredCredentials = {
+      access_token: token.access_token,
+      refresh_token: token.refresh_token,
+      expires_at: expiresAt,
+      user_email: userEmail,
+    }
+
+    await credentialStorage.save(credentials)
+  }
+
+  // Get valid access token
+  async getValidAccessToken(): Promise<string | null> {
+    const credentials = await credentialStorage.load()
+    if (!credentials) {
+      return null
+    }
+
+    // Check if token is expired
+    if (credentials.expires_at < Date.now() / 1000) {
+      try {
+        const newToken = await this.refreshAccessToken(
+          credentials.refresh_token,
+        )
+        await this.storeTokens(newToken, credentials.user_email)
+        return newToken.access_token
+      } catch (error) {
+        // Token refresh failed, need to re-authenticate
+        await credentialStorage.clear()
+        return null
+      }
+    }
+
+    return credentials.access_token
+  }
+
+  // Logout and clear stored tokens
+  async logout(): Promise<void> {
+    const credentials = await credentialStorage.load()
+
+    if (credentials) {
+      try {
+        const body = new URLSearchParams({
+          client_id: process.env.KEYCLOAK_CLIENT_ID!,
+          refresh_token: credentials.refresh_token,
+        })
+
+        // Optionally call Keycloak logout endpoint
+        await this.client.post(process.env.KEYCLOAK_LOGOUT_ENDPOINT!, body, {
+          headers: {
+            "Content-Type": "application/x-www-form-urlencoded",
+            ...this.buildClientAuthHeaders(),
+          },
+        })
+      } catch (error) {
+        // Continue with local logout even if server call fails
+      }
+    }
+
+    // Clear local credentials
+    await credentialStorage.clear()
+  }
+
+  /**
+   * Check if user is authenticated
+   */
+  async isAuthenticated(): Promise<boolean> {
+    const credentials = await credentialStorage.load()
+    return credentials !== null
+  }
+}
+
+export const authService = new AuthenticationService()

package/src/commands/auth.ts

@@ -0,0 +1,114 @@
+import open from "open"
+import { authService } from "../auth/index.js"
+import { startCallbackServer } from "../auth/callback.js"
+import { credentialStorage } from "../storage/credentials.js"
+import chalk from "chalk"
+
+export async function handleLogin() {
+  try {
+    // 1. Check if logged in
+    const isAuth = await authService.isAuthenticated()
+    if (isAuth) {
+      console.log("Already logged in. Use 'deploily logout' to log out first.")
+      return
+    }
+    console.log("Opening browser for authentication...")
+
+    // 2. Generate authorization URL
+    const { url, context } = authService.generateAuthorizationUrl()
+
+    // 3. Start callback server
+    const callbackPromise = startCallbackServer(context.state)
+
+    // 4. Open browser
+    await open(url)
+
+    console.log("Waiting for authentication...")
+
+    // 5. Wait for callback
+    const callback = await callbackPromise
+
+    // 6. Exchange code for token
+    const tokens = await authService.exchangeCodeForToken(
+      callback.code,
+      context.codeVerifier,
+    )
+
+    // 7. Get user info
+    const userInfo = await authService.getUserInfo(tokens.access_token)
+
+    // 8. Store tokens
+    await authService.storeTokens(tokens, userInfo.email)
+    console.log("Successfully authenticated")
+    console.log(`Welcome, ${userInfo.email}!`)
+  } catch (error) {
+    console.error("Error occurred while logging in:", error)
+    process.exit(1)
+  }
+}
+
+export async function handleLogout() {
+  try {
+    const isAuth = await authService.isAuthenticated()
+
+    if (!isAuth) {
+      console.log("You are not logged in.")
+      return
+    }
+
+    await authService.logout()
+    console.log("Successfully logged out")
+  } catch (error) {
+    console.error("Error occurred while logging in:", error)
+    process.exit(1)
+  }
+}
+
+export async function handleWhoami() {
+  try {
+    const isAuth = await authService.isAuthenticated()
+
+    if (!isAuth) {
+      console.log(
+        "You are not logged in. Use `deploily login` to authenticate.",
+      )
+      process.exit(1)
+    }
+
+    // Get stored credentials
+    const credentials = await credentialStorage.load()
+
+    if (!credentials) {
+      console.log(
+        "You are not logged in. Use `deploily login` to authenticate.",
+      )
+      process.exit(1)
+    }
+
+    // Get user info from API
+    const userInfo = await authService.getUserInfo(credentials.access_token)
+
+    console.log("Current User:")
+    console.log(`├─ Email: ${userInfo.email}`)
+    console.log(`├─ Name: ${userInfo.name}`)
+    console.log(`├─ Username: ${userInfo.preferred_username}`)
+
+    // Calculate token expiry
+    const expiresAt = new Date(credentials.expires_at * 1000)
+    const now = new Date()
+    const timeRemaining = Math.floor(
+      (credentials.expires_at * 1000 - now.getTime()) / 1000,
+    )
+
+    if (timeRemaining > 0) {
+      const hours = Math.floor(timeRemaining / 3600)
+      const minutes = Math.floor((timeRemaining % 3600) / 60)
+      console.log(chalk.gray(`└─ Token expires in: ${hours}h ${minutes}m`))
+    } else {
+      console.log(chalk.gray(`└─ Token expires in: Soon (will auto-refresh)`))
+    }
+  } catch (error) {
+    console.error("Error occurred while logging in:", error)
+    process.exit(1)
+  }
+}

package/src/config/constants.ts

@@ -0,0 +1,28 @@
+import "dotenv/config"
+
+export const AUTH_CONFIG = {
+  // Keycloak Configuration
+  KEYCLOAK_REALM_URL: process.env.KEYCLOAK_REALM_URL!,
+  KEYCLOAK_TOKEN_ENDPOINT: process.env.KEYCLOAK_TOKEN_ENDPOINT!,
+  KEYCLOAK_AUTH_ENDPOINT: process.env.KEYCLOAK_AUTH_ENDPOINT!,
+  KEYCLOAK_LOGOUT_ENDPOINT: process.env.KEYCLOAK_LOGOUT_ENDPOINT!,
+  KEYCLOAK_USERINFO_ENDPOINT: process.env.KEYCLOAK_USERINFO_ENDPOINT!,
+
+  // CLI Configuration
+  CLIENT_ID: process.env.KEYCLOAK_CLIENT_ID!,
+  CLIENT_SECRET: process.env.KEYCLOAK_CLIENT_SECRET!,
+  REDIRECT_URI: process.env.KEYCLOAK_REDIRECT_URI!,
+  CALLBACK_PORT: 8976,
+  SCOPE: "openid profile email",
+  RESPONSE_TYPE: "code",
+  CODE_CHALLENGE_METHOD: "S256",
+
+  // Token Configuration
+  TOKEN_EXPIRY_BUFFER: 60,
+}
+
+export const STORAGE_CONFIG = {
+  SERVICE_NAME: "deploily-cli",
+  CONFIG_DIR: "~/.config/deploily",
+  CONFIG_FILE: "config.json",
+}

package/src/index.ts

@@ -0,0 +1,69 @@
+#!/usr/bin/env node
+import { handleLogin, handleLogout, handleWhoami } from "./commands/auth.js"
+
+const VERSION = "1.0.0" // TODO: read from package.json
+
+async function main() {
+  const args = process.argv.slice(2)
+  const command = args[0]
+
+  if (!command || command === "--help" || command === "-h") {
+    showHelp()
+    return
+  }
+
+  if (command === "--version" || command === "-v") {
+    console.log(`deploily version ${VERSION}`)
+    return
+  }
+
+  try {
+    switch (command) {
+      case "login":
+        await handleLogin()
+        break
+
+      case "logout":
+        await handleLogout()
+        break
+
+      case "whoami":
+        await handleWhoami()
+        break
+
+      default:
+        console.error(`Unknown command: ${command}`)
+        showHelp()
+        process.exit(1)
+    }
+  } catch (err) {
+    console.error(`Error executing command '${command}':`, err)
+    process.exit(1)
+  }
+}
+
+function showHelp() {
+  console.log(`
+Usage:
+  deploily [command]
+
+Commands:
+  login        Authenticate with Keycloak
+  logout       Clear authentication tokens
+  whoami       Show current user information
+
+Options:
+  --help, -h   Show this help message
+  --version    Show version number
+
+Examples:
+  deploily login
+  deploily logout
+  deploily whoami
+`)
+}
+
+main().catch((err) => {
+  console.error(err)
+  process.exit(1)
+})